With the fast development of the Internet, the number of broadband network users is increasing rapidly. During the procedure of the operators constructing the broadband networks, networking mode has developed from Asynchronous Transfer Mode Digital Subscriber Line Access Multiplexer (ATM DSLAM) to Internet Protocol Digital Subscriber Line Access Multiplexer (IP DSLAM). The uplink of the ATM DSLAM adopts a DSLAM with ATM ports, while the uplink of the IP DSLAM adopts a DSLAM with GE ports or FE ports. Edge service nodes connecting to the DSLAM uplink is Broadband Remote Access Server (BRAS).
With the ever-increasing network scale and the increasing number of network users, security problems are becoming more and more severe. Account intrusions and hacker attacks are becoming more and more intense. In addition, with the prevalence of online movies, video services, online games and IP phones, the requirement for broadband and real-time services are becoming higher and higher, so it is more and more important for the operators to provide different services according to different users or different applications. Therefore, it is an urgent issue for the operators to manage and maintain the online equipment simply, conveniently and efficiently. However, at present the DSLAM cannot communicate with such equipment as the BRAS or policy servers, so other problems will be brought in while resolving the above-mentioned problems. The solutions for solving network security problems, Quality of Service (QoS) implementations, multicast videos, network management and so on, as well as the accompanying problems, will be described in detail.
In terms of the network security problem of the hacker attacks, the primary means in the broadband equipment is to quarantine the user to interdict the user from affecting other users, so that damages to the users are confined in a very small scope. In a DSLAM network framework that adopts the ATM-uplink, the general adopted means is to establish a Permanent Virtual Channel (PVC) from the DSLAM to the BRAS for each Asymmetric Digital Subscriber Line (ADSL) user, so that different PVCs are quarantined; in an IP DSLAM network framework, the general adopted means is to allocate a Virtual Local Area Network Identity (VLAN ID) for each user, so that different users are interdicted from visiting one another.
In terms of the network security problem of the account intrusions, the present solution is to bind the account with a port identity and authenticate the legality of the user with the cooperation of a Remote Authentication Dial-In User Service (RADIUS) Server. The port identity of a user is the PVC of the user in the ATM DSLAM; and is the VLAN ID of the user in the IP DSLAM. The PVC of the user or the VLAN ID of the user identifies a unique actual online user. The BRAS captures the authentication message of the user, takes out the account information of the user and sends the account information together with the port information of the user to the RADIUS Server; the RADIUS Server determines whether the account information and the port identity are legal so as to decide whether the user can log on to the network. The port information of the user is the VLAN ID or the Virtual Path Identifier (VPI) and Virtual Channel Identifier (VCI) of the PVC.
The above-mentioned solutions for network security problems in terms of hacker attacks or account intrusions all need to use the user PVC of the ATM DSLAM or VLAN ID of the IP DSLAM. The number of PVC in the ATM DSLAM is determined by the values of VPI and VCI. According to the definition of VPI and VCI in an ATM Cell, at the user network side, VPI is 8-bit while VCI is 16-bit, so 256 (the number of VPI)×65536 (the number of VCI)=16777216 users are supported. The supported number of the users completely satisfies the quantity requirement of the users accessing the DSLAM, so that the user is uniquely identified by using PVC and thus account intrusions and hacker attacks are prevented by using PVC.
However, in terms of the IP DSLAM, most of the networking modes adopting IP DSLAM uplinks are: FE or GE interface uplinks access to BRAS through GE interfaces after being aggregated by LAN Switches. VLAN ID is currently defined as 12-bit and supports 4096 users at most. In other words, if each user is allocated with a VLAN ID, there will be at most 4096 users aggregated at an GE interface; when there are more than 4096 user ports, multiple users will certainly share one VLAN ID, so it is impossible either to avoid hacker attacks by setting a unique VLAN ID for each user, or to avoid account intrusions by binding the VLAN ID with the user account.
The physical port of each user connected to the DSLAM is unique. If a user can be identified through his physical port, the ports and users will be mapped one by one no matter how many users there are. But the current BRAS cannot acquire the physical port information and thus cannot solve the problem of account intrusions by bonding the physical port with the user account.
Similarly, if a user can be identified by his physical port and the physical port of the user can be bound with information such as the address of the user, the problem of hacker attacks can be solved by monitoring whether the user is a hacker through the binding relation. But the current BRAS cannot acquire the physical port information to avoid hacker attacks by bonding the physical port with the address information.
Services like video services, online movies and VoIP demand that network equipment provide different services in terms of different applications, i.e. implement QoS functions. At present, there are two ways to provide QoS bandwidth guarantee, which are Integrated Service and Differentiated Service.
1. Integrated Service needs to apply for a specific service from the network before sending traffic, and the application is performed by the signaling. Service application programs, such as a VoIP telephone client program, a VOD client program and so on, transmit their own flow parameter and the required specific QoS request to the network through the signaling. The specific QoS request includes bandwidth, delay and so on; the client service application program sends the traffic after receiving a confirmation from the network, i.e. after the network has reserved some certain resources for the service application program; the traffic sent by the service application program should be controlled within the scope described by the flow parameter.
2. Differentiated Service is different from Integrated Service. Signaling is not necessary in Differentiated Service, in other words, the service application program does not need to notify the network before sending out the traffic. According to Differentiated Service, the network only needs to provide service for each message according to the preset service policy or according to the priority of the message entering the network, rather than maintain the status for every flow.
As a multi-service edge node, a BRAS needs to receive Access Control List (ACL) rules and QoS policies that are issued by such policy servers like a RADIUS Server. The BRAS performs QoS policy control upon the received user message according to the received ACL rule and QoS policy. Because QoS is a kind of service based on end-to-end mode, the DSLAM also needs to perform priority control and management of the bandwidth, the delay and the jitter according to the type of the message service. In other words, the DSLAM needs to obtain and process the ACL rule and QoS policy information accordingly. But as layer-2 equipment, the DSLAM is mainly used for aggregating the user ports and transparently transmitting messages from the user ports, and the service processing ability of the DSLAM is too weak to perform policy information interactions with such equipment as policy servers. If the DSLAM is going to support QoS function relying on Integrated Service, the DSLAM needs to run such protocols as QoS resource reserve protocol, which are all based on layer-3 or higher layer protocols and which demand the DSLAM receive and process related protocol messages, but the DSLAM is the layer-2 equipment and the current DSLAM cannot satisfy the above-mentioned requirement; as to Differentiated Service, the DSLAM has to configure ACL and QoS policy by itself, which obviously makes it impossible to implement dynamic QoS policy adjustment according to different users. Obviously, if the BRAS can transmit the ACL rule and QoS policy information to the DSLAM, the above-mentioned problems can be solved.
As a very important service in Triple-play services, the IP TV multicast video service can be implemented by several measures in the existing IP DSLAM-based broadband access network.
1. an IP DSLAM supports IGMP snooping, and a BRAS provides IGMP proxy function. The multicast authority of a user is transmitted to the BRAS through network Element Management System (EMS) or a policy server as a RADIUS Server, and the user authority control is performed in the BRAS. Multicast copy can be implemented through the IP DSLAM that supports IGMP;
2. an IP DSLAM supports IGMP proxy, the multicast authority of a user is directly sent to the IP DSLAM through EMS. The user authority control is performed in the IP DSLAM and multicast copy can also be implemented through the IP DSLAM;
3. an IP DSLAM does not support IGMP protocol, and a BRAS provides IGMP proxy function. The multicast authority of a user is controlled in the BRAS and multicast copy can only be implemented in the BRAS based on the users. The IP DSLAM cannot provide multicast copy function.
Among the above-mentioned three measures, the first measure is applicable basically.
As to the second measure, the operator may utilize an existing RADIUS Server in the network to store the multicast authority information, and the multicast authority information is uniformly issued to the DSLAM by the RADIUS Server instead of being directly issued through EMS. But the existing RADIUS Server in the network generally interacts with the BRAS rather than with the DSLAM, so the existing mechanism cannot transmit the multicast authority information to the DSLAM from the Radius Server.
As to the third measure, the IP DSLAM has no multicast copy function and the copy can only be executed by the BRAS. If more than one user belonging to a same IP DSLAM apply for a same program, the BRAS will copy the same video data flow for multiple times and then transmit the copies to the users. The solution is not accordant with the original intention of the multicast copy mechanism and may lead to severe bandwidth waste of the access network. One solution improving the third measure is that the BRAS transmits the multicast copy information to the IP DSLAM, so that the IP DSLAM will complete the last level copy. The advantage of the improved solution is that the IP DSLAM needs not to support and detect IGMP protocol messages and thus the requirement for the performance of IP DSLAM is not that high.
Besides, the management upon a DSLAM mostly adopts a network manager mode or a command line mode. Either the network manager mode or the command line mode is adopted, each DSLAM needs to occupy a management IP address; as to the command line mode, the management upon a DSLAM demands logging in to the DSLAM to perform operations; while for the network manager mode, each DSLAM is represented as an independent network element in a network manager terminal, and the management is performed in terms of every element. The above-mentioned modes of managing each DSLAM are called distributive management. Obviously, the distributive management will lead to a waste of IP addresses and the management is inconvenient, thus the cost of maintenance and operation is increased.
To sum up, because of the lack of corresponding protocols between the network equipment, i.e. between a BRAS and a DSLAM, useful information can not be transferred, the above-mentioned various solutions causing the above problems have to be adopted.